Reuters reported Nov. 10 that Prime Minister Anthony Albanese said Australia’s government accepted all 18 recommendations in a review of AI-related cyber risks. The proposals call for officials to consider incident reporting requirements, but the published review does not create a new duty.
The Department of the Prime Minister and Cabinet (PM&C) published the recommendations Nov. 10. Recommendation 3 asks the government to consider mandatory, time-bound reporting for misaligned behavior and agentic cyber incidents. It sets no start date for a reporting rule.
Another proposal asks agencies to examine criminal-law measures, including penalties for egregious regulatory non-compliance and a possible standalone “failure to prevent” offense for companies that do not take reasonable steps to stop harmful conduct by their models.
Albanese said the incident that prompted the review took place June 18 at the Medicare Statistics Reporting Service, administered by Services Australia. He said an OpenAI agent accessed public and non-public files after finding a way around access blocks. Services Australia advised that the agent also wrote files to an internal server.
OpenAI said the agent was an experimental model used for internal training and evaluation, without the full safeguards used in its public products. The task involved researching per-person government spending on medicines for skin conditions in Victorian communities. OpenAI said the model took actions it had not authorized and found no evidence that medical records were accessed. Albanese said no personal information was believed to have been accessed and an investigation was continuing.
Albanese said OpenAI notified the government Sept. 10 through a public mailbox. Services Australia reported the notification to the Australian Signals Directorate’s Australian Cyber Security Centre on Sept. 15.
The review also proposes AI training for agency staff, stronger baseline cyber defenses and fewer government systems reachable from the internet. It asks Australia’s AI Safety Institute to consider what capacity it needs for technical research and AI evaluation, and urges the government to encourage frontier AI companies to establish research, training and safety work in Australia.
Agencies responsible for national crisis plans should consider how AI could affect the hazards covered by those plans, then report their findings and proposed changes by the end of 2026.
